Apple is urging its customers to report all suspicious emails. This follows the discovery of a scam that attempts to steal credit card details by posing as a billing notice.
Hackers designed the phishing campaign to mimic an App Store subscription notice for YouTube Red, a paid streaming service owned by Google. The booby-trapped email uses an near-identical format to a real Apple invoice and informs victims they will be charged $144.99 unless they click a link to cancel the service.
"You have purchased the following subscription with a 1 month free trial," the email reads. "Once it ends, your subscription will renew at $144.99 unless you cancel." The pace of the scheme increased in recent weeks, 9to5Mac reported Tuesday.
Clicking the link redirects to a fake webpage asking the recipient to sign in to their Apple account and insert personal information, including credit card details.
The Silicon Valley technology giant has stressed in a newly updated notice to its customers that it would never request such data.
"If you receive an email about an App Store or iTunes Store purchase, and you're not sure whether it is real, you can look for a couple of things that can help confirm that the message is from Apple," the firm said on its website.
"Genuine purchase receipts—from...the App Store, iTunes Store, iBooks Store, or Apple Music—include your current billing address, which scammers are unlikely to have," it continued. "You can also review your App Store, iTunes Store, iBooks Store, or Apple Music purchase history."
FRAUD ALERT! Apple app store phishing emails. Scammers email a fake invoice and ask you to click on a link within it if you did not authorize the purchase.Tip: Apple emails come from @apple.com and they will always your name^sr
— Halton Police (@HaltonPolice) February 23, 2018
The company said it would never ask for a customer's social security mumber, full credit card number, mother's maiden name or credit card CCV code. It advised anyone who received a suspicious email to send it to reportphishing@apple.com.
Why phishing works
Javvad Malik, a computer expert for U.S-headquartered cybersecurity firm AlienVault, told Newsweek that phishing remains popular for one reason: it works. "Phishing is a common method of attack because all too often users will inadvertently fall for a scam in error, haste, or fear of being charged/billed for something," he said.
Malik said that anyone can quickly check for fake messages by "looking out for poor grammar and spelling, checking where the email has originated from, and whether email is the usual way of communication." He added: "[Email] users should make themselves familiar with knowing how to spot phishing attacks."
Apple is frequently targeted by cybercriminals. In 2016, UK-based security commentator Graham Cluley exposed a credential-stealing scam that was spreading via SMS, claiming users' Apple IDs had expired. Last year, Felix Krause, an iOS coder, published research showing how a mobile phishing campaign designed to steal Apple passwords could be created in 15 minutes.
